CVE-2025-62522 Scanner
CVE-2025-62522 Scanner - Information Disclosure vulnerability in Vite
Used 2.7k times · 3.4k assets checked · domain, subdomain, ipv4
CVE
CVE-2025-62522
6.0
CVSSmedium
Exploitable remotely over the internet · no authentication required.
Description
Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.
Attack Vector
Network
Privileges Req.
None
User Interaction
P
vite
Updated Oct 12, 2026View on NVD →
S4E scanner
CVE history: vite
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →